Incident Response Process CSA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which section should be included in an incident report to provide a chronological account of the incident?

   • AList of employee salaries
   • BTimeline of events
   • CCompany holiday schedule
   • DMarketing strategy
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo reduce the storage space required for evidence
   • BTo encrypt the evidence for secure transmission
   • CTo speed up the forensic analysis process
   • DTo ensure the evidence is admissible in legal proceedings
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC analyst is investigating a possible data breach. The analyst has logs from the firewall, the authentication server, and the file server. Which correlation would most strongly indicate a data breach?

   • AA user account authenticated successfully from a foreign IP, then accessed a large number of sensitive files, and then large outbound data transfer was logged.
   • BA file server logged a user accessing files during business hours.
   • CA firewall logged a large inbound data transfer from the internet.
   • DA user account failed to authenticate several times from the internal network.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   After an incident has been contained and eradicated, what is the primary goal of the recovery phase?

   • AIdentifying the root cause of the incident
   • BRestoring affected systems to normal operation
   • CCollecting evidence for legal proceedings
   • DUpdating the incident response plan
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company has confirmed a ransomware infection on a file server. The malware is actively encrypting files. The incident response team needs to stop the spread while preserving evidence. Which containment action should be taken FIRST?

   • ARestore the file server from backup immediately
   • BPower off the file server to stop the encryption process
   • CIsolate the file server from the network by disconnecting its network cable
   • DDelete the ransomware executable from the file server
   Reveal Solution Discussion Select an answer first